- 22 Jan, 2020 1 commit
-
-
Anthony Steinhauser authored
Even though ERET always causes a jump to another address, aarch64 CPUs speculatively execute following instructions as if the ERET instruction was not a jump instruction. The speculative execution does not cross privilege-levels (to the jump target as one would expect), but it continues on the kernel privilege level as if the ERET instruction did not change the control flow - thus execution anything that is accidentally linked after the ERET instruction. Later, the results of this speculative execution are always architecturally discarded, however they can leak data using microarchitectural side channels. This speculative execution is very reliable (seems to be unconditional) and it manages to complete even relatively performance-heavy operations (e.g. multiple dependent fetches from uncached memory). This was fixed in Linux, FreeBSD, OpenBSD and Optee OS: https://github.com/torvalds/linux/commit/679db70801da9fda91d26caf13bf5b5ccc74e8e8 https://github.com/freebsd/freebsd/commit/29fb48ace4186a41c409fde52bcf4216e9e50b61 https://github.com/openbsd/src/commit/3a08873ece1cb28ace89fd65e8f3c1375cc98de2 https://github.com/OP-TEE/optee_os/commit/abfd092aa19f9c0251e3d5551e2d68a9ebcfec8a It is demonstrated in a SafeSide example: https://github.com/google/safeside/blob/master/demos/eret_hvc_smc_wrapper.cc https://github.com/google/safeside/blob/master/kernel_modules/kmod_eret_hvc_smc/eret_hvc_smc_module.c Signed-off-by: Anthony Steinhauser <asteinhauser@google.com> Change-Id: Iead39b0b9fb4b8d8b5609daaa8be81497ba63a0f
-
- 23 Dec, 2019 1 commit
-
-
Madhukar Pappireddy authored
Erratum 1688305 is a Cat B erratum present in r0p0, r0p1 versions of Hercules core. The erratum can be avoided by setting bit 1 of the implementation defined register CPUACTLR2_EL1 to 1 to prevent store- release from being dispatched before it is the oldest. Change-Id: I2ac04f5d9423868b6cdd4ceb3d0ffa46e570efed Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
-
- 24 Oct, 2019 1 commit
-
-
laurenw-arm authored
Fix a few white space errors and remove #if defined in workaround for N1 Errata 1542419. Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com> Change-Id: I07ac5a2fd50cd63de53c06e3d0f8262871b62fad
-
- 04 Oct, 2019 1 commit
-
-
laurenw-arm authored
Coherent I-cache is causing a prefetch violation where when the core executes an instruction that has recently been modified, the core might fetch a stale instruction which violates the ordering of instruction fetches. The workaround includes an instruction sequence to implementation defined registers to trap all EL0 IC IVAU instructions to EL3 and a trap handler to execute a TLB inner-shareable invalidation to an arbitrary address followed by a DSB. Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com> Change-Id: Ic3b7cbb11cf2eaf9005523ef5578a372593ae4d6
-
- 03 Oct, 2019 1 commit
-
-
Imre Kis authored
Change-Id: I1ea2bf088f1e001cdbd377cbfb7c6a2866af0422 Signed-off-by: Imre Kis <imre.kis@arm.com>
-
- 02 Oct, 2019 1 commit
-
-
Imre Kis authored
Change-Id: I645442d52a295706948e2cac88c36c1a3cb0bc47 Signed-off-by: Imre Kis <imre.kis@arm.com>
-
- 30 Sep, 2019 1 commit
-
-
Artsem Artsemenka authored
Not tested on FVP Model. Change-Id: Iedebc5c1fbc7ea577e94142b7feafa5546f1f4f9 Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>
-
- 11 Sep, 2019 1 commit
-
-
John Tsichritzis authored
Zeus supports the SSBS mechanism and also the new MSR instruction to immediately apply the mitigation. Hence, the new instruction is utilised in the Zeus-specific reset function. Change-Id: I962747c28afe85a15207a0eba4146f9a115b27e7 Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
-
- 19 Aug, 2019 1 commit
-
-
laurenw-arm authored
ISB instruction was removed from the N1 1043202 Errata Workaround [1], this fix is adding the ISB instruction back in. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com> Change-Id: I74eac7f6ad38991c36d423ad6aa44558033ad388
-
- 16 Aug, 2019 1 commit
-
-
Alexei Fedorov authored
This patch fixes FVP_Base_AEMv8A model hang issue with ARMv8.4+ with cache modelling enabled configuration. Incorrect L1 cache flush operation to PoU, using CLIDR_EL1 LoUIS field, which is required by the architecture to be zero for ARMv8.4-A with ARMv8.4-S2FWB feature is replaced with L1 to L2 and L2 to L3 (if L3 is present) cache flushes. FVP_Base_AEMv8A model can be configured with L3 enabled by setting `cluster0.l3cache-size` and `cluster1.l3cache-size` to non-zero values, and presence of L3 is checked in `aem_generic_core_pwr_dwn` function by reading CLIDR_EL1.Ctype3 field value. Change-Id: If3de3d4eb5ed409e5b4ccdbc2fe6d5a01894a9af Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
-
- 31 Jul, 2019 1 commit
-
-
Balint Dobszay authored
Change-Id: Ie0a94783d0c8e111ae19fd592304e6485f04ca29 Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
-
- 16 Jul, 2019 1 commit
-
-
Louis Mayencourt authored
Change-Id: Iab767e9937f5c6c8150953fcdc3b37e8ee83fa63 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
-
- 10 Jul, 2019 1 commit
-
-
Balint Dobszay authored
Change-Id: I755e4c42242d9a052570fd1132ca3d937acadb13 Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
-
- 02 Jul, 2019 10 commits
-
-
lauwal01 authored
Replacing ISB instructions in each Errata workaround with a single ISB instruction before the RET in the reset handler. Change-Id: I08afabc5b98986a6fe81664cd13822b36cab786f Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1275112 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set a bit in the implementation defined CPUACTLR_EL1 system register, which delays instruction fetch after branch misprediction. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: If7fe55fe92e656fa6aea12327ab297f2e6119833 Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1262888 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set a bit in the implementation defined CPUECTLR_EL1 system register, which disables the MMU hardware prefetcher. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: Ib733d748e32a7ea6a2783f3d5a9c5e13eee01105 Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1262606 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set a bit in the implementation defined CPUACTLR_EL1 system register, which delays instruction fetch after branch misprediction. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: Idd980e9d5310232d38f0ce272862e1fb0f02ce9a Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1257314 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set a bit in the implementation defined CPUACTLR3_EL1 system register, which prevents parallel execution of divide and square root instructions. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: I54f0f40ff9043efee40d51e796b92ed85b394cbb Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1220197 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set two bits in the implementation defined CPUECTLR_EL1 system register, which disables write streaming to the L2. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: I9c3373f1b6d67d21ee71b2b80aec5e96826818e8 Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1207823 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set a bit in the implementation defined CPUACTLR2_EL1 system register. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: Ia932337821f1ef0d644db3612480462a8d924d21 Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1165347 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set two bits in the implementation defined CPUACTLR2_EL1 system register. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: I163d0ea00578245c1323d2340314cdc3088c450d Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1130799 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set a bit in the implementation defined CPUACTLR2_EL1 system register. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: I252bc45f9733443ba0503fefe62f50fdea61da6d Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
lauwal01 authored
Neoverse N1 erratum 1073348 is a Cat B erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set a bit in the implementation defined CPUACTLR_EL1 system register, which disables static prediction. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdoc-466751330-10325/index.html Change-Id: I674126c0af6e068eecb379a190bcf7c75dcbca8e Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
-
- 11 Jun, 2019 1 commit
-
-
Louis Mayencourt authored
Change-Id: Idd08914bcb945ad6aa0621e594c95df88ee8f9c8 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
-
- 06 Jun, 2019 2 commits
-
-
Andre Przywara authored
Neoverse N1 erratum 1315703 is a Cat A (rare) erratum [1], present in older revisions of the Neoverse N1 processor core. The workaround is to set a bit in the implementation defined CPUACTLR2_EL1 system register, which will disable the load-bypass-store feature. [1] http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.pjdocpjdoc-466751330-1032/index.html Change-Id: I5c708dbe0efa4daa0bcb6bd9622c5efe19c03af9 Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-
Andrew F. Davis authored
We previously left our caches on during power-down to prevent any non-caching accesses to memory that is cached by other cores. Now with the last accessed areas all being marked as non-cached by USE_COHERENT_MEM we can rely on that to workaround our interconnect issues. Remove the old workaround. Change-Id: Idadb7696d1449499d1edff4f6f62ab3b99d1efb7 Signed-off-by: Andrew F. Davis <afd@ti.com>
-
- 04 Jun, 2019 1 commit
-
-
John Tsichritzis authored
Some cores support only AArch64 mode. In those cores, only a limited subset of the AArch32 system registers are implemented. Hence, if TF-A is supposed to run on AArch64-only cores, it must be compiled with CTX_INCLUDE_AARCH32_REGS=0. Currently, the default settings for compiling TF-A are with the AArch32 system registers included. So, if we compile TF-A the default way and attempt to run it on an AArch64-only core, we only get a runtime panic. Now a compile-time check has been added to ensure that this flag has the appropriate value when AArch64-only cores are included in the build. Change-Id: I298ec550037fafc9347baafb056926d149197d4c Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
-
- 28 May, 2019 1 commit
-
-
Ambroise Vincent authored
The workaround is added to the Cortex-A55 cpu specific file. The workaround is disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I3e6fd10df6444122a8ee7d08058946ff1cc912f8 Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
-
- 24 May, 2019 1 commit
-
-
Alexei Fedorov authored
This patch adds the functionality needed for platforms to provide Branch Target Identification (BTI) extension, introduced to AArch64 in Armv8.5-A by adding BTI instruction used to mark valid targets for indirect branches. The patch sets new GP bit [50] to the stage 1 Translation Table Block and Page entries to denote guarded EL3 code pages which will cause processor to trap instructions in protected pages trying to perform an indirect branch to any instruction other than BTI. BTI feature is selected by BRANCH_PROTECTION option which supersedes the previous ENABLE_PAUTH used for Armv8.3-A Pointer Authentication and is disabled by default. Enabling BTI requires compiler support and was tested with GCC versions 9.0.0, 9.0.1 and 10.0.0. The assembly macros and helpers are modified to accommodate the BTI instruction. This is an experimental feature. Note. The previous ENABLE_PAUTH build option to enable PAuth in EL3 is now made as an internal flag and BRANCH_PROTECTION flag should be used instead to enable Pointer Authentication. Note. USE_LIBROM=1 option is currently not supported. Change-Id: Ifaf4438609b16647dc79468b70cd1f47a623362e Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
-
- 14 May, 2019 1 commit
-
-
Sami Mujawar authored
Examine the ID_AA64PFR1_EL1 bits 7:4 to see if speculative loads (SSBS) is implemented, before disabling speculative loads. Change-Id: I7607c45ed2889260d22a94f6fd9af804520acf67 Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
-
- 07 May, 2019 2 commits
-
-
Soby Mathew authored
The workaround for Cortex-A76 errata #1286807 is implemented in this patch. Change-Id: I6c15af962ac99ce223e009f6d299cefb41043bed Signed-off-by: Soby Mathew <soby.mathew@arm.com>
-
Soby Mathew authored
The workarounds for errata 1257314, 1262606, 1262888 and 1275112 are added to the Cortex-A76 cpu specific file. The workarounds are disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I70474927374cb67725f829d159ddde9ac4edc343 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
-
- 03 May, 2019 1 commit
-
-
John Tsichritzis authored
This patch fixes this issue: https://github.com/ARM-software/tf-issues/issues/660 The introduced changes are the following: 1) Some cores implement cache coherency maintenance operation on the hardware level. For those cores, such as - but not only - the DynamIQ cores, it is mandatory that TF-A is compiled with the HW_ASSISTED_COHERENCY flag. If not, the core behaviour at runtime is unpredictable. To prevent this, compile time checks have been added and compilation errors are generated, if needed. 2) To enable this change for FVP, a logical separation has been done for the core libraries. A system cannot contain cores of both groups, i.e. cores that manage coherency on hardware and cores that don't do it. As such, depending on the HW_ASSISTED_COHERENCY flag, FVP includes the libraries only of the relevant cores. 3) The neoverse_e1.S file has been added to the FVP sources. Change-Id: I787d15819b2add4ec0d238249e04bf0497dc12f3 Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
-
- 25 Apr, 2019 1 commit
-
-
Andrew F. Davis authored
Errata 819472, 824069, and 827319 are currently reported in a warning as missing during boot for platforms that do not need them. Only warn when the errata is needed for a given revision but not compiled in like other errata workarounds. Fixes: bd393704 ("Cortex-A53: Workarounds for 819472, 824069 and 827319") Signed-off-by: Andrew F. Davis <afd@ti.com> Change-Id: Ifd757b3d0e73a9bd465b98dc20648b6c13397d8d
-
- 18 Apr, 2019 1 commit
-
-
Louis Mayencourt authored
This patch forces all cacheable atomic instructions to be near, which improves performance in highly contended parallelized use-cases. Change-Id: I93fac62847f4af8d5eaaf3b52318c30893e947d3 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
-
- 17 Apr, 2019 3 commits
-
-
Louis Mayencourt authored
Under certain near idle conditions, DSU may miss response transfers on the ACE master or Peripheral port, leading to deadlock. This workaround disables high-level clock gating of the DSU to prevent this. Change-Id: I820911d61570bacb38dd325b3519bc8d12caa14b Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
-
Louis Mayencourt authored
Change-Id: I50708f6ccc33059fbfe6d36fd66351f0b894311f Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
-
Louis Mayencourt authored
Under specific conditions, the processor might issue an eviction and an L2 cache clean operation to the interconnect in the wrong order. Set the CPUACTLR.ENDCCASCI bit to 1 to avoid this. Change-Id: Ide7393adeae04581fa70eb9173b742049fc3e050 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
-
- 08 Apr, 2019 1 commit
-
-
Alexei Fedorov authored
Change-Id: I0a81f4ea94d41245cd5150de341b51fc70babffe Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
-
- 14 Mar, 2019 1 commit
-
-
John Tsichritzis authored
Change-Id: If56d1e200a31bd716726d7fdc1cc0ae8a63ba3ee Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
-